@slicedearth/whoisleuth-cli 2.4.0 → 2.6.0

package/packages/investigation/pdf-intake.mjs

@@ -0,0 +1,155 @@
+import { getDocument, ImageKind, OPS } from 'pdfjs-dist/legacy/build/pdf.mjs';
+import { createDocumentIntake } from "./document-intake.mjs";
+import { MAX_DOCUMENT_IMAGE_PIXELS, MAX_DOCUMENT_PAGES, MAX_DOCUMENT_TEXT_BYTES, MAX_DOCUMENT_PAGE_OPERATIONS } from "../contracts/document-intake.mjs";
+import { readEvidenceImageDimensions } from "../evidence/image-regions.mjs";
+import { MAX_INTAKE_LINKS, MAX_INTAKE_URL_LENGTH } from "../contracts/message-intake.mjs";
+/** No document-controlled resource can reach a filesystem or network fetcher. */
+class NoExternalBinaryData {
+    async fetch() { throw new TypeError('External PDF resources are not loaded.'); }
+}
+function imagePixels(raw) {
+    if (!raw || typeof raw !== 'object')
+        throw new TypeError('The PDF image is unavailable.');
+    const value = raw;
+    const { width, height } = readEvidenceImageDimensions(value.width, value.height);
+    if (!(value.data instanceof Uint8Array) && !(value.data instanceof Uint8ClampedArray))
+        throw new TypeError('The PDF image has no supported pixel data.');
+    const data = value.data, count = width * height, pixels = new Uint8ClampedArray(count * 4);
+    if (value.kind === ImageKind.RGBA_32BPP && data.length === pixels.length)
+        pixels.set(data);
+    else if (value.kind === ImageKind.RGB_24BPP && data.length === count * 3) {
+        for (let index = 0; index < count; index++) {
+            pixels.set(data.subarray(index * 3, index * 3 + 3), index * 4);
+            pixels[index * 4 + 3] = 255;
+        }
+    }
+    else if (value.kind === ImageKind.GRAYSCALE_1BPP && data.length === Math.ceil(width / 8) * height) {
+        const stride = Math.ceil(width / 8);
+        for (let y = 0; y < height; y++)
+            for (let x = 0; x < width; x++) {
+                const colour = data[y * stride + (x >> 3)] & (128 >> (x % 8)) ? 255 : 0;
+                pixels.set([colour, colour, colour, 255], (y * width + x) * 4);
+            }
+    }
+    else
+        throw new TypeError('The PDF image pixel layout is unsupported.');
+    return { width, height, pixels };
+}
+export async function reviewPdfInput(bytes, reviewedAt, worker) {
+    const review = await createDocumentIntake(bytes, 'pdf', reviewedAt);
+    // PDF.js takes ownership of its input. The selected original stays unchanged.
+    const task = getDocument({ data: bytes.slice(), ...(worker ? { worker } : {}),
+        BinaryDataFactory: NoExternalBinaryData, useWorkerFetch: false, useWasm: false,
+        useSystemFonts: false, disableFontFace: true, enableXfa: false,
+        isOffscreenCanvasSupported: false, isImageDecoderSupported: false,
+        maxImageSize: MAX_DOCUMENT_IMAGE_PIXELS, stopAtErrors: true, verbosity: 0,
+        disableAutoFetch: true, disableStream: true, disableRange: true });
+    try {
+        const document = await task.promise;
+        const total = document.numPages, admitted = Math.min(total, MAX_DOCUMENT_PAGES);
+        review.pages(total, 0);
+        if (total > admitted)
+            review.partial('Further PDF pages exceed the page review bound.');
+        if (document.isPureXfa) {
+            review.unavailable('unsupported', 'XFA documents are not rendered or executed.');
+            return review.finish();
+        }
+        let textCharacters = 0;
+        for (let pageNumber = 1; pageNumber <= admitted; pageNumber++) {
+            const page = await document.getPage(pageNumber);
+            try {
+                const reader = page.streamTextContent().getReader();
+                let text = '';
+                try {
+                    for (;;) {
+                        const chunk = await reader.read();
+                        if (chunk.done)
+                            break;
+                        for (const item of chunk.value.items) {
+                            if (typeof item.str !== 'string')
+                                continue;
+                            textCharacters += item.str.length + 1;
+                            if (textCharacters > MAX_DOCUMENT_TEXT_BYTES) {
+                                review.partial('Further PDF text exceeds the text review bound.');
+                                break;
+                            }
+                            text += item.str + (item.hasEOL ? '\n' : ' ');
+                        }
+                        if (textCharacters > MAX_DOCUMENT_TEXT_BYTES) {
+                            await reader.cancel();
+                            break;
+                        }
+                    }
+                    await review.text(text, pageNumber);
+                }
+                catch {
+                    review.partial(`Text on page ${pageNumber} could not be fully decoded.`);
+                }
+                finally {
+                    reader.releaseLock();
+                }
+                try {
+                    const annotations = await page.getAnnotations(), destinations = [];
+                    for (const annotation of annotations) {
+                        if (typeof annotation.url !== 'string')
+                            continue;
+                        if (annotation.url.length > MAX_INTAKE_URL_LENGTH || destinations.length >= MAX_INTAKE_LINKS) {
+                            review.partial(`Some links on page ${pageNumber} exceed the link review bound.`);
+                            continue;
+                        }
+                        destinations.push(annotation.url);
+                    }
+                    await review.destinations(destinations, pageNumber);
+                }
+                catch {
+                    review.partial(`Links on page ${pageNumber} could not be fully decoded.`);
+                }
+                try {
+                    const operations = await page.getOperatorList(), seen = new Set();
+                    if (operations.fnArray.length > MAX_DOCUMENT_PAGE_OPERATIONS)
+                        review.partial(`Image operations on page ${pageNumber} exceed the review bound.`);
+                    else
+                        for (let index = 0; index < operations.fnArray.length; index++) {
+                            const operation = operations.fnArray[index], args = operations.argsArray[index];
+                            let raw;
+                            if (operation === OPS.paintImageXObject || operation === OPS.paintImageXObjectRepeat) {
+                                const id = args?.[0];
+                                if (typeof id !== 'string' || seen.has(id))
+                                    continue;
+                                seen.add(id);
+                                raw = await new Promise(resolve => (id.startsWith('g_') ? page.commonObjs : page.objs).get(id, resolve));
+                            }
+                            else if (operation === OPS.paintInlineImageXObject)
+                                raw = args?.[0];
+                            else
+                                continue;
+                            try {
+                                await review.image(imagePixels(raw), pageNumber);
+                            }
+                            catch {
+                                review.partial(`An image on page ${pageNumber} has unsupported or unavailable pixels.`);
+                            }
+                        }
+                }
+                catch {
+                    review.partial(`Image operations on page ${pageNumber} could not be fully decoded.`);
+                }
+                review.pages(total, pageNumber);
+            }
+            finally {
+                page.cleanup();
+            }
+        }
+        review.partial('QR review covers decoded embedded raster images, not vector artwork or a rendered-page reconstruction. Scripts, forms, embedded files and external resources are not executed or opened.');
+    }
+    catch (cause) {
+        if (cause instanceof Error && cause.name === 'PasswordException')
+            review.unavailable('encrypted', 'The PDF requires a password. Review an explicitly decrypted copy; no password was requested or retained.');
+        else
+            review.unavailable('unsupported', 'The PDF could not be decoded completely within this review. The original bytes are unchanged.');
+    }
+    finally {
+        await task.destroy();
+    }
+    return review.finish();
+}

package/packages/investigation/platform-continuity-review.mjs

@@ -0,0 +1,60 @@
+import { array, enumeration, exact, iso, text } from "../evidence/artifact-structure.mjs";
+import { pageObservationOrigin } from "./page-behaviour.mjs";
+import { CASE_PROVIDER_OUTCOMES, CASE_OBSERVED_EFFECT_STATES } from "../cases/case-response-records.mjs";
+import { CONTEXT_REVIEW_SCHEMA, CONTEXT_REVIEW_VERSION, MAX_CONTEXT_RECORDS } from "../contracts/context-review.mjs";
+export { PLATFORM_CONTINUITY_INPUT_SCHEMA, PLATFORM_CONTINUITY_INPUT_VERSION } from "../contracts/context-review.mjs";
+export const PLATFORM_OBJECT_TYPES = ['account', 'tenant', 'application', 'extension', 'package', 'page', 'channel', 'post'];
+export const PLATFORM_REPORT_STATES = ['not_reported', 'submitted', 'acknowledged'];
+export function readPlatformObjects(raw) {
+    const rows = array(raw, 'Platform objects', MAX_CONTEXT_RECORDS).map(value => {
+        const row = exact(value, ['platformOrigin', 'objectType', 'objectId', 'version', 'observedAt', 'source', 'report', 'providerOutcome', 'recheck', 'recheckedAt'], 'Platform object');
+        const platformOrigin = text(row.platformOrigin, 'Platform origin', 500);
+        if (pageObservationOrigin(platformOrigin) !== platformOrigin)
+            throw new TypeError('Platform origin must be an HTTP(S) origin without credentials, paths or query data.');
+        const objectId = text(row.objectId, 'Stable object ID', 240);
+        if (!/^[A-Za-z0-9_@.:%/+~-]+$/u.test(objectId))
+            throw new TypeError('Stable object ID must contain identifier characters, not free text.');
+        iso(row.observedAt, 'Object observation time');
+        iso(row.recheckedAt, 'Object recheck time', true);
+        const recheck = enumeration(row.recheck, CASE_OBSERVED_EFFECT_STATES, 'Object recheck');
+        if ((recheck === 'not_checked') !== (row.recheckedAt === null))
+            throw new TypeError('A recheck result needs its own observation time; unchecked objects must not carry one.');
+        if (row.recheckedAt !== null && Date.parse(row.recheckedAt) < Date.parse(row.observedAt))
+            throw new TypeError('Object recheck predates its observation.');
+        const report = enumeration(row.report, PLATFORM_REPORT_STATES, 'Report status');
+        const providerOutcome = row.providerOutcome === null ? null : enumeration(row.providerOutcome, CASE_PROVIDER_OUTCOMES, 'Provider outcome');
+        if (providerOutcome !== null && report === 'not_reported')
+            throw new TypeError('A provider outcome needs a reported object.');
+        return { platformOrigin, objectType: enumeration(row.objectType, PLATFORM_OBJECT_TYPES, 'Platform object type'), objectId,
+            version: row.version === null ? null : text(row.version, 'Object version', 100), observedAt: row.observedAt, source: text(row.source, 'Object source', 500), report, providerOutcome, recheck, recheckedAt: row.recheckedAt };
+    });
+    const identities = rows.map(row => JSON.stringify([row.platformOrigin, row.objectType, row.objectId, row.version, row.observedAt]));
+    if (new Set(identities).size !== rows.length)
+        throw new TypeError('Duplicate platform object observations must be reconciled explicitly.');
+    return rows;
+}
+export function groupPlatformObjects(rows) {
+    const groups = new Map();
+    for (const row of rows) {
+        const key = JSON.stringify([row.platformOrigin, row.objectType, row.objectId]);
+        groups.set(key, [...(groups.get(key) ?? []), row]);
+    }
+    return [...groups.values()].map(values => values.sort((a, b) => Date.parse(a.observedAt) - Date.parse(b.observedAt)));
+}
+export function reviewPlatformContinuity(raw, reviewedAt) {
+    iso(reviewedAt, 'Review time');
+    const rows = readPlatformObjects(raw), groups = groupPlatformObjects(rows);
+    const observations = [];
+    for (const values of groups) {
+        const versions = new Set(values.map(row => row.version).filter(value => value !== null));
+        for (const row of values)
+            observations.push({ label: `${row.objectType} · ${row.objectId}${row.version ? ` · version ${row.version}` : ''}`, state: 'reported',
+                detail: `${row.report.replaceAll('_', ' ')}; provider outcome: ${row.providerOutcome?.replaceAll('_', ' ') ?? 'not supplied'}; independent recheck: ${row.recheck.replaceAll('_', ' ')}${row.recheckedAt ? ` at ${row.recheckedAt}` : ''}. ${versions.size > 1 ? `${versions.size} versions retained for this same declared object.` : 'No version change established.'}`,
+                source: `${row.platformOrigin} · ${row.source}`, observedAt: row.observedAt, hostname: new URL(row.platformOrigin).hostname });
+    }
+    const unresolved = rows.filter(row => ['not_checked', 'still_observed', 'changed', 'unavailable'].includes(row.recheck)).length;
+    return { schema: CONTEXT_REVIEW_SCHEMA, version: CONTEXT_REVIEW_VERSION, kind: 'platform_continuity', reviewedAt, title: 'Platform object continuity',
+        state: rows.length ? 'reviewed' : 'partial', summary: `Recorded observations: ${rows.length}; distinct platform objects: ${groups.length}; observations needing follow-up or a qualified outcome: ${unresolved}.`, observations,
+        nextSteps: ['Use the exact object and version when preparing a provider report; do not report an entire shared platform from a hosted URL alone.', 'Record each report and recheck separately. New versions, changed content and newly observed objects require their own review.'],
+        limitations: ['Platform origin, object identity and outcomes are analyst-supplied metadata, not verified provider telemetry.', 'A matching object ID establishes only declared continuity within that platform and object type. Provider resolution is separate from independent recheck; not reproduced does not establish worldwide removal.'] };
+}

package/packages/investigation/qr-intake.mjs

@@ -0,0 +1,56 @@
+import { binarize, Decoder, Detector } from '@nuintun/qrcode';
+import { decodeEvidencePng } from "../evidence/png-pixels.mjs";
+import { assertMessageBytes, reviewMessageInput } from "./message-intake.mjs";
+import { readEvidenceImageDimensions } from "../evidence/image-regions.mjs";
+export const MAX_QR_DETECTION_ATTEMPTS = 256;
+export function decodeQrPixels(image) {
+    readEvidenceImageDimensions(image.width, image.height);
+    if (!(image.pixels instanceof Uint8ClampedArray) || image.pixels.length !== image.width * image.height * 4)
+        throw new TypeError('Invalid QR pixel surface.');
+    const luminance = new Uint8Array(image.width * image.height);
+    for (let index = 0; index < luminance.length; index++) {
+        const offset = index * 4, alpha = image.pixels[offset + 3] / 255;
+        luminance[index] = Math.round((image.pixels[offset] * 0.299 + image.pixels[offset + 1] * 0.587 + image.pixels[offset + 2] * 0.114) * alpha + 255 * (1 - alpha));
+    }
+    const texts = new Set();
+    let attempts = 0, bounded = false, structured = false;
+    // Normal and inverted symbols are both considered, without altering originals.
+    for (const inverted of [false, true]) {
+        if (inverted)
+            for (let index = 0; index < luminance.length; index++)
+                luminance[index] = 255 - luminance[index];
+        const candidates = new Detector().detect(binarize(luminance, image.width, image.height)), decoder = new Decoder();
+        let candidate = candidates.next();
+        while (!candidate.done) {
+            if (++attempts > MAX_QR_DETECTION_ATTEMPTS) {
+                bounded = true;
+                candidates.return();
+                break;
+            }
+            let decoded = false;
+            try {
+                const symbol = decoder.decode(candidate.value.matrix);
+                decoded = true;
+                if (symbol.structured)
+                    structured = true;
+                else if (symbol.content.length <= 8_192)
+                    texts.add(symbol.content);
+                else
+                    bounded = true;
+            }
+            catch { /* A finder-pattern candidate need not contain a decodable symbol. */ }
+            candidate = candidates.next(decoded);
+        }
+        if (bounded)
+            break;
+    }
+    return { texts: [...texts], bounded, structured };
+}
+export async function reviewQrInput(bytes, reviewedAt) {
+    assertMessageBytes(bytes);
+    const { texts, bounded, structured } = decodeQrPixels(decodeEvidencePng(bytes));
+    const result = await reviewMessageInput(bytes, 'qr', reviewedAt, texts);
+    const boundsReached = [...result.report.coverage.boundsReached, ...(bounded ? ['QR candidate work'] : []), ...(structured ? ['Multi-symbol structured content requires reassembly'] : [])];
+    return { ...result, report: { ...result.report, coverage: { ...result.report.coverage,
+                state: boundsReached.length ? 'partial' : result.report.coverage.state, boundsReached } } };
+}

package/packages/investigation/requested-action-hints.mjs

@@ -0,0 +1,11 @@
+const HINTS = {
+    clipboard_instruction: /(?:clipboard|copy.{0,40}(?:paste|command)|paste.{0,40}(?:terminal|run|console))/iu,
+    shell_instruction: /(?:powershell|cmd\.exe|curl\s|wget\s|terminal|windows\s*\+\s*r)/iu,
+    verification_prompt: /(?:verify.{0,40}(?:human|browser)|not a robot|captcha|browser.{0,40}(?:repair|update))/iu,
+    device_code_instruction: /(?:device[ -]code|enter.{0,40}code.{0,40}(?:sign|login|log in))/iu,
+    consent_instruction: /(?:grant.{0,40}(?:access|permission)|consent|approve.{0,40}(?:application|permission))/iu,
+};
+/** Wording matches are review leads, never a conclusion about intent or execution. */
+export function requestedActionHints(value) {
+    return Object.entries(HINTS).filter(([, expression]) => expression.test(value)).map(([hint]) => hint);
+}

package/packages/investigation/selected-input-review.mjs

@@ -0,0 +1,17 @@
+/** One format dispatch for browser and CLI; parsers load only when selected. */
+export async function reviewSelectedInput(bytes, kind, reviewedAt, pdfWorker) {
+    switch (kind) {
+        case 'text':
+        case 'email':
+        case 'calendar': return (await import("./message-intake.mjs")).reviewMessageInput(bytes, kind, reviewedAt);
+        case 'qr': return (await import("./qr-intake.mjs")).reviewQrInput(bytes, reviewedAt);
+        case 'docx': return (await import("./docx-intake.mjs")).reviewDocxInput(bytes, reviewedAt);
+        case 'pdf': return (await import("./pdf-intake.mjs")).reviewPdfInput(bytes, reviewedAt, pdfWorker);
+        case 'har': return (await import("./har-intake.mjs")).reviewHarInput(bytes, reviewedAt);
+        case 'identity': return (await import("./identity-event-intake.mjs")).reviewIdentityEventInput(bytes, reviewedAt);
+        default: {
+            const unsupported = kind;
+            throw new TypeError(`Unsupported selected input: ${String(unsupported)}`);
+        }
+    }
+}

package/packages/investigation/storefront-review.mjs

@@ -0,0 +1,70 @@
+import { array, boolean, domain, enumeration, exact, HEX_DIGEST_RE, iso, text } from "../evidence/artifact-structure.mjs";
+import { pageObservationOrigin } from "./page-behaviour.mjs";
+import { CONTEXT_REVIEW_SCHEMA, CONTEXT_REVIEW_VERSION, MAX_CONTEXT_RECORDS } from "../contracts/context-review.mjs";
+export { STOREFRONT_INPUT_SCHEMA, STOREFRONT_INPUT_VERSION } from "../contracts/context-review.mjs";
+export const STOREFRONT_FIELDS = [
+    { id: 'brandNames', label: 'Displayed brand names', treatment: 'text' },
+    { id: 'contactDomains', label: 'Published contact domains', treatment: 'domain' },
+    { id: 'policyHashes', label: 'Policy text SHA-256 digests', treatment: 'hash' },
+    { id: 'checkoutOrigins', label: 'Checkout destinations', treatment: 'origin' },
+    { id: 'paymentMethods', label: 'Advertised payment methods', treatment: 'text' },
+    { id: 'assetHashes', label: 'Distinctive asset SHA-256 digests', treatment: 'hash' },
+];
+export function readStorefrontObservation(raw) {
+    const row = exact(raw, ['hostname', 'observedAt', 'source', ...STOREFRONT_FIELDS.map(field => field.id)], 'Storefront observation');
+    domain(row.hostname, 'Storefront hostname');
+    iso(row.observedAt, 'Storefront observation time');
+    const fields = {};
+    let count = 0;
+    for (const field of STOREFRONT_FIELDS) {
+        if (row[field.id] === null) {
+            fields[field.id] = null;
+            continue;
+        }
+        const values = array(row[field.id], field.label, MAX_CONTEXT_RECORDS);
+        count += values.length;
+        if (count > MAX_CONTEXT_RECORDS)
+            throw new TypeError('A storefront observation exceeds the aggregate evidence-item bound.');
+        fields[field.id] = [...new Set(values.map(value => {
+                const candidate = text(value, field.label, 500);
+                if (field.treatment === 'domain')
+                    domain(candidate, field.label);
+                if (field.treatment === 'hash' && !HEX_DIGEST_RE.test(candidate))
+                    throw new TypeError('Storefront digests must be lowercase hexadecimal SHA-256.');
+                if (field.treatment === 'origin' && pageObservationOrigin(candidate) !== candidate)
+                    throw new TypeError('Checkout observations retain HTTP(S) origins only.');
+                return candidate;
+            }))].sort();
+    }
+    return { hostname: row.hostname, observedAt: row.observedAt, source: text(row.source, 'Storefront source', 500), ...fields };
+}
+export function reviewStorefront(raw, reviewedAt) {
+    iso(reviewedAt, 'Review time');
+    const input = exact(raw, ['official', 'candidate', 'authorisedComparator', 'resellerStatus', 'resellerSource'], 'Storefront comparison');
+    boolean(input.authorisedComparator, 'Comparator authority');
+    if (!input.authorisedComparator)
+        throw new TypeError('Confirm that the official comparator is owned or authorised for this review.');
+    const official = readStorefrontObservation(input.official), candidate = readStorefrontObservation(input.candidate);
+    if (official.hostname === candidate.hostname)
+        throw new TypeError('Select a different candidate hostname for storefront comparison.');
+    const reseller = enumeration(input.resellerStatus, ['authorised', 'not_authorised', 'unknown'], 'Reseller status');
+    const resellerSource = input.resellerSource === null ? null : text(input.resellerSource, 'Reseller evidence', 500);
+    if (reseller !== 'unknown' && !resellerSource)
+        throw new TypeError('A reseller-status declaration needs its source or authority reference.');
+    const observations = [];
+    let missing = 0;
+    for (const field of STOREFRONT_FIELDS) {
+        const left = official[field.id], right = candidate[field.id];
+        if (left === null || right === null)
+            missing++;
+        const shared = left && right ? right.filter(value => left.includes(value)) : [];
+        observations.push({ label: field.label, state: left === null || right === null ? 'unknown' : 'observed',
+            detail: `Official: ${left === null ? 'not reviewed' : left.length ? left.join(', ') : 'no values recorded'}. Candidate: ${right === null ? 'not reviewed' : right.length ? right.join(', ') : 'no values recorded'}. ${left !== null && right !== null ? `Exact shared values: ${shared.length}.` : 'No comparison established.'}`,
+            source: `${official.hostname} · ${official.source} · ${official.observedAt} / ${candidate.hostname} · ${candidate.source}`, observedAt: candidate.observedAt, hostname: candidate.hostname });
+    }
+    observations.push({ label: 'Reseller or affiliate authority', state: reseller === 'unknown' ? 'unknown' : 'reported', detail: reseller.replaceAll('_', ' '), source: resellerSource ?? 'No authority evidence supplied', observedAt: null, hostname: candidate.hostname });
+    return { schema: CONTEXT_REVIEW_SCHEMA, version: CONTEXT_REVIEW_VERSION, kind: 'storefront', reviewedAt, title: 'Storefront comparison', state: missing ? 'partial' : 'reviewed',
+        summary: `${candidate.hostname} compared with the authorised reference ${official.hostname}; evidence categories missing one side: ${missing}.`, observations,
+        nextSteps: ['Check reseller, affiliate and regional-store authority before preparing a complaint.', 'Retain the source pages and distinctive assets privately; select relevant findings in the Case response packet.', 'Use the observed checkout platform and the rights or policy evidence to choose a reporting route. Do not enter payment information or submit an order.'],
+        limitations: ['This compares analyst-supplied observations. It does not collect a page, verify a merchant, submit a payment or issue a scam score.', 'Shared wording, assets and payment providers can have legitimate explanations. Digests establish byte equality only when inputs were captured consistently; missing observations do not establish absence.'] };
+}